feat: durcit l'exécution SQL IA, borne les uploads et ajoute des tests

- sql_executor: remplace le filtre regex fragile par une autorisation SQLite
  (set_authorizer) en complément de mode=ro ; rejette les instructions multiples
- uploads: lecture bornée des PDF (helper read_upload_limited, limite 20 Mo,
  HTTP 413) branchée sur /extract et /save-with-pdf
- tests: suite pytest (54 tests) couvrant amounts, dates, storage, sql_executor,
  uploads et DatabaseService.save_document ; pytest ajouté en dépendance dev

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/plesna_gerance/api/routes/documents.py

@@ -13,6 +13,7 @@ from ...database import get_session, DatabaseService, storage
 from ...database.models import Document, Immeuble, Lot, Locataire, Revenu, Depense
 from ...database.service import DuplicateDocumentError
 from ...extractor import extract_compte_rendu
+from ...utils.uploads import read_upload_limited, UploadTooLargeError
 from ..schemas import SaveRequest, SaveResponse, DocumentSummary
 
 router = APIRouter(prefix="/api", tags=["documents"])
@@ -103,9 +104,11 @@ async def save_document_with_pdf(
                 status_code=400, detail=f"JSON invalide pour depenses_tags: {e}"
             )
 
-    # Read PDF content
+    # Read PDF content (taille bornée)
     try:
-        pdf_content = await pdf_file.read()
+        pdf_content = await read_upload_limited(pdf_file)
+    except UploadTooLargeError as e:
+        raise HTTPException(status_code=413, detail=str(e))
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"Erreur lecture du PDF: {str(e)}")